@@ -130,15 +130,34 @@ jobs:
130130 if : >-
131131 steps.check-label.outputs.hasTopic == 'true' &&
132132 steps.check-release.outputs.isLatestRelease == 'true'
133+ env :
134+ CHANGELOG : ${{ github.event.release.body }}
133135 run : |
136+ # Set the metainfo file and placeholder generated by the release asset.
134137 xml_file="flathub/${{ env.FLATHUB_PKG }}/${{ env.FLATHUB_PKG }}.metainfo.xml"
138+ placeholder="<!-- changelog -->"
139+
140+ # Treat replacement text literally during Bash parameter substitutions.
141+ shopt -u patsub_replacement 2>/dev/null || true
142+
143+ # Escape XML-sensitive characters from the release body.
144+ changelog="${CHANGELOG:-}"
145+ changelog="${changelog//&/&}"
146+ changelog="${changelog//</<}"
147+ changelog="${changelog//>/>}"
148+
149+ # Read the full metainfo file, preserving newlines.
150+ IFS= read -r -d '' contents < "$xml_file" || true
135151
136- # Extract release information
137- changelog="${{ github.event.release.body }}" && changelog="${changelog//&/&}" && \
138- changelog="${changelog//</<}" && changelog="${changelog//>/>}"
152+ # Fail clearly if the generated metainfo file no longer has the expected marker.
153+ if [[ "$contents" != *"$placeholder"* ]]; then
154+ echo "$placeholder not found in $xml_file"
155+ exit 1
156+ fi
139157
140- # Replace changelog placeholder with actual changelog
141- sed -i "s|<!-- changelog -->|$changelog|g" "$xml_file"
158+ # Replace the placeholder with the escaped changelog and write the file back.
159+ contents="${contents//$placeholder/$changelog}"
160+ printf '%s' "$contents" > "$xml_file"
142161
143162 - name : Update submodule
144163 if : >-
0 commit comments